Users Deleting files on the server

[Backspace]

Big problem here, yesterday I was called to one of the businesses I service, upon arrival I could tell that someone had deleted most the files in one of the directories of a program they use (and of course dont pay for support for) Anyway here is my question, I need to somehow lock it down so nobody can delete on this drive, heres the problem, this program doesnt like the no delete permission set on the drive itself, so what I would like to know is , is there another way, I guess im hoping there is some kind of user level restriction maybe. The next question is, does anyone know a way or a software package somewhere that can log who deletes stuff, if I cant stop them from deleting at least I could know who did it, I wont go into details, but I feel it was purposly done, not accidental in this case.

[Stalemate]

Change all the administrator passwords and review the users' rights and privileges on the server's shared directories.

Remove users from the administrator (or domain administrator) group and make sure none of them can access the server's drives by only allowing those shares that are needed for your application.

Remove the "erase" or equivalent right from the users too, just in case, unless it's needed by the application in question.

[tk421]

there are lots of programs that monitor who is doing what over the network. redhand 8.0 looks pretty good. go to download.com and do a search for "network activity monitor", or variants. try some out.

[Ya_know]

You didn't describe the way you have things configured for this application. Is it a shared app from a server; what OS is installed on the server? Are you dealing with a Domain, or a workgroup; and what OS is on the workstations?

Please add any of these more pertinent details with a second post...

[Backspace]

Its a Windows 2000 Server, domain, the clients are Win98se, the app is on a shared drive on the server.

[ilovetheusers]

Lock the files down with the NTFS permissions then. Or, create a group on the server that has certain rights to the folder and deny all delete rights.